How to fix Permission denied (publickey). in SSH

Check if you have SSH keys on your local machine:

ls -la ~/.ssh/

Look for files like id_rsa (private key) and id_rsa.pub (public key). If they don't exist, generate a new key pair:

ssh-keygen -t ed25519 -C "[email protected]"

Press Enter to accept the default location (~/.ssh/id_ed25519) and optionally set a passphrase.

SSH is very strict about file permissions. Incorrect permissions will cause this error:

chmod 700 ~/.ssh
chmod 600 ~/.ssh/id_rsa
chmod 644 ~/.ssh/id_rsa.pub
chmod 644 ~/.ssh/known_hosts  # if it exists
chmod 600 ~/.ssh/config        # if it exists

Verify the permissions are correct:

ls -la ~/.ssh/

Expected output:
- drwx------ (700) for ~/.ssh
- -rw------- (600) for private keys
- -rw-r--r-- (644) for public keys

The easiest way is using ssh-copy-id:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@remote-host

Replace user with the correct username and remote-host with the server address.

If ssh-copy-id is not available, manually add it:

1. View your public key:

cat ~/.ssh/id_rsa.pub

2. Copy the entire output (starts with ssh-rsa or ssh-ed25519)

3. Log into the server with password authentication (if available):

ssh user@remote-host

4. On the server, ensure the ~/.ssh directory exists and has correct permissions:

mkdir -p ~/.ssh
chmod 700 ~/.ssh

5. Append your public key:

echo "your-public-key-here" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

6. Exit the server and try connecting again.

If you have multiple SSH keys, SSH might be trying the wrong one first. Use the -v flag to see which key is being used:

ssh -v user@remote-host

Look for lines like:

Trying private key: /home/user/.ssh/id_rsa

If it's trying the wrong key, explicitly specify the correct one:

ssh -i ~/.ssh/id_ed25519 user@remote-host

To make this the default for a specific host, add it to your SSH config (~/.ssh/config):

Host remote-host
  User user
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes

Log into the remote server (using password auth if available) and verify your public key is there:

cat ~/.ssh/authorized_keys

Your public key should appear as a single line starting with ssh-rsa or ssh-ed25519. If it's missing, add it using the steps above.

Also verify file permissions on the server:

ls -la ~/.ssh/authorized_keys

Should be -rw------- (600) or -rw-r--r-- (644). If permissions are wrong:

chmod 600 ~/.ssh/authorized_keys

If none of the above worked, use maximum verbosity to see exactly where the authentication is failing:

ssh -vvv user@remote-host

Common output patterns and what they mean:

"No more authentication methods to try"
- All authentication methods failed; the public key wasn't accepted

"Authentications that can continue: publickey"
- Server requires publickey auth, but your key was rejected

"No identity files matched"
- SSH couldn't find any keys in the expected locations

"Permission denied" after "Offering public key"
- Key was found but doesn't match what's in authorized_keys on the server

Check the server logs too (if you have access):

sudo tail -f /var/log/auth.log | grep ssh

Look for messages like "Invalid user", "Authentication refused", or "key_type not in PubkeyAcceptedAlgorithms".